I have the following setup on an Ubuntu machine:

~/dotfiles/authorized_keys2
~/.ssh/authorized_keys2 -> /home/wayne/dotfiles/authorized_keys2

I had the same setup on my Arch machine, but when I connect with -v,

debug1: Authentications that can continue: publickey,password
debug1: Next authentication method: publickey
debug1: Offering RSA public key: /home/wayne/.ssh/id_rsa
debug1: Authentications that can continue: publickey,password

I found this page on the Arch Wiki, which has this line:

$ chmod 600 ~/.ssh/authorized_keys

So I added another symlink:

authorized_keys -> /home/wayne/dotfiles/authorized_keys2

And yet still, no dice. And yes, I have ensured that the correct key is present in authorized_keys.

Why can I not connect using my keys?

Edit:

My permissions are set correctly on my home and ssh folders (and key file):

drwxr-x--x 150 wayne       family  13k Aug 27 07:38 wayne/
drwx------   2 wayne       family 4.1k Aug 27 07:24 .ssh/
-rw-------   1 wayne       family 6.4k Aug 20 07:01 authorized_keys2
  • there's something in /etc/... in the pam folder maybe? that might be wrong. some conf,though. – mikeserv Aug 27 '14 at 12:51
  • 2
    Did you change the chmod of authorized_keys2 too? if not, try to set chmod 600 on authorized_keys2. Put it on the source file, not on the link. – Chen A. Aug 27 '14 at 12:51
  • Have you checked where the sshd looks for authorized keys in your sshd config? – unR Aug 27 '14 at 13:29
  • AuthorizedKeysFile .ssh/authorized_keys, @unR – Wayne Werner Aug 27 '14 at 13:49
  • Looks like PubkeyAuthentication yes is commented out... though manpage says yes is the default and uncommenting that seems to have no effect – Wayne Werner Aug 27 '14 at 13:49
up vote 8 down vote accepted

The permissions on your authorized_keys file and the directories leading to it must be sufficiently restrictive: they must be only writable by you or root (recent versions of OpenSSH also allow them to be group-writable if you are the single user in that group). See Why am I still getting a password prompt with ssh with public key authentication? for the full story.

In your case, authorized_keys is a symbolic link. As of OpenSSH 5.9 (I haven't checked other versions), in that case, the server checks the permissions leading to the ultimate target of the symbolic link, with all intermediate symbolic links expanded (the canonical path). Assuming that all components of /home/wayne/dotfiles/authorized_keys2 are directories except for the last one which is a regular files, OpenSSH checks the permissions of /home/wayne, /home/wayne/dotfiles and /home/wayne/dotfiles/authorized_keys2.

If you have root access on the server, check the server logs for a message of the form bad ownership or modes for ….

  • The nugget about the symbolic link was key for me here. One of my setups require that the user home be the website root within /var/www/vhosts/... In order to allow that user to login via ssh I had to create a /home/username with the .ssh/authorized_keys file within it. Setting up the symlink ln -s /home/username/.ssh .ssh from within the home directory of the user logged in. – Dez Nov 30 '15 at 14:41

I had the same issue, got resolved by changing permissions of /home/user directory which was not correct it should be chmod 755

If SELINUX is set to enforcing, and the canonical path to your authorized_keys file has a symlink for any of the directories, it will fail. You need to set SELINUX to disabled.

  • Welcome to *nix.SE! Consider expanding your post with links to documentation or explanation which supports your suggestion. – HalosGhost Sep 17 '14 at 16:33

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.